docs: record the group 0.14 / rand_core 0.10 upstream blocker#54
Open
dobby-coder[bot] wants to merge 1 commit into
Open
docs: record the group 0.14 / rand_core 0.10 upstream blocker#54dobby-coder[bot] wants to merge 1 commit into
dobby-coder[bot] wants to merge 1 commit into
Conversation
The bump is blocked upstream by the pairing crate: group 0.14.0 and ff 0.14.0 are stable (on rand_core 0.10), but the only pairing 0.24 is a pre-release pinning group =0.14.0-pre.0 (on rand_core 0.9). pg-curve must implement the pairing traits used throughout ibe, so it cannot move to group 0.14 until a stable pairing 0.24 (or bls12_381 0.9) ships. Sharpens the existing "rand/getrandom bumps are blocked" note in CLAUDE.md with the precise, empirically-verified blocker so the next attempt can skip the crates.io investigation. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
![dobby-coder[bot]](https://avatars.githubusercontent.com/in/3365457?s=60&v=4){kind=small}
Contributor
Author
There was a problem hiding this comment.
VERDICT: approve
Rules Dobby 2 — clean sign-off (self-authored, so posted as COMMENT).
Docs-only change to CLAUDE.md recording the verified upstream blocker for the group 0.14 / rand_core 0.10 bump. Reviewed against the rules that apply to a docs/dep-investigation PR:
- writing-rules: the added note is factual and technical, no AI-slop tells; the
As of 2026-07-16date records when crates.io state was checked and matches the file's existing style. - conventional-commit-pr-titles: title is compliant (pr-title.yml enforces).
- pr-close-issue-keywords:
Refs #53is correctly non-closing — the issue stays open to track a stablepairing 0.24. - pr-review-assignments: reviewer @rubenhensen assigned.
No rule findings, no review findings. Approving.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Records the precise, verified reason the
group 0.14/rand_core 0.10bump cannot land yet, sharpening the existing dependency-constraint note inCLAUDE.md. No dependency change ships in this PR because none compiles today (see below).The blocker: the
pairingcrate has no stablegroup 0.14releaseibepassespg-curve's curve types intogroup/pairingtrait bounds and callsmulti_miller_loop,pairing,Gt,G2Preparedthroughoutsrc/ibe/*andsrc/kem/*, so thepairingsfeature is required andpg-curvemust implement thepairingcrate's traits.pg-curveis a fork ofbls12_381.The current state on crates.io:
rand_coregroup0.14.0ff0.14.0pairing0.23.0group ^0.13pairing0.24.0-pre.0group =0.14.0-pre.0, which is onrand_core 0.9, not 0.10bls12_381(upstream)0.8.0group 0.13So there is no stable
pairingrelease compatible withgroup 0.14.0.pg-curvecannot move togroup 0.14/rand_core 0.10until upstream ships a stablepairing 0.24(orbls12_381 0.9), which does not exist yet.Verified empirically
Bumping
pg-curve'sCargo.tomltopairing = "0.24"fails resolution:Forcing the full pre-release stack (
group =0.14.0-pre.0,ff =0.14.0-pre.0,pairing =0.24.0-pre.0) resolvesrand_coreto 0.9 (and pulls in duplicaterand_core0.6/0.9 copies), so it does not reachrand_core 0.10and is unsuitable for production crypto regardless.Consequence for the chain
The chain
pg-curve → ibe → ibs → postguardstays blocked atpg-curve. This confirms and refines encryption4all/ibe#41:group 0.14/ff 0.14are now out, butpairingis the remaining gate. Nothing to pick back up on encryption4all/postguard#195 until a stablepairing 0.24ships.Refs #53